Quick answer: LLMNR and NBT-NS poisoning is an internal network attack that exploits a weakness in local name resolution on Windows networks. When a victim cannot resolve a name, it broadcasts to the network, and the attacker replies with a fake answer to capture the authentication material (an NTLM hash). This hash is then either cracked or forwarded to another system with NTLM relay to gain access. The foundation of defense is disabling LLMNR and NBT-NS and enforcing SMB signing.

How does the attack work?

When a Windows computer cannot resolve a name (for example a mistyped server name), it first asks DNS, and if that fails it broadcasts to the whole local network with LLMNR and NBT-NS asking "who knows this name." The problem is that anyone can answer this broadcast.

The attacker listens to these broadcasts on the network and replies with a fake answer saying "that server is me." The victim trusts the attacker and sends it an authentication attempt. This attempt contains the user's NTLM hash. The attacker has now captured this hash.

What is done with the captured hash?

Method Description
Hash cracking The captured NTLM hash is cracked offline into a password
NTLM relay Without cracking, it is forwarded to another system to log in there
Lateral movement Moving to other systems on the network with the access gained

NTLM relay is especially dangerous because the password does not even need to be cracked. The captured authentication is forwarded directly to a system where SMB signing is not enforced, and a session is opened there.

Why is it so common and effective?

This attack is one of the most frequently used and fastest producing techniques in internal network penetration tests. The reason is that LLMNR and NBT-NS are enabled by default on many Windows networks and no one notices. By merely listening on the network and waiting, the attacker can collect credentials from a single mistyped server name.

Defense

  1. Disable LLMNR via Group Policy.
  2. Turn off NBT-NS (NetBIOS over TCP/IP).
  3. Enforce SMB signing on all systems, which largely stops NTLM relay.
  4. Use Kerberos instead of NTLM where possible, and restrict NTLM.
  5. Make cracking the captured hash harder with a strong password policy.
  6. Monitor unusual broadcast responses and authentication patterns on the internal network.

The KAOS and DSET approach

DSET tests LLMNR/NBT-NS poisoning and NTLM relay paths in an authorized way during internal network and Active Directory penetration tests and ties them to evidence. The situation we most often see in the field is these two protocols being enabled by default and SMB signing not being enforced, which together lead to rapid network compromise. Our KAOS security engine reports these weaknesses and the impact of the access gained. Our goal is not fear but showing the real path to credentials and the priority for closing it.

Related reading: Active Directory attack techniques BloodHound, privilege escalation and lateral movement, Active Directory internal penetration testing Kerberoasting, password cracking Hashcat John, leaked passwords and credential stuffing, MITRE ATT&CK framework.

Frequently asked questions

Does disabling LLMNR and NBT-NS break anything? On most modern networks LLMNR and NBT-NS can be disabled, because name resolution is already done with DNS. Before disabling, you should check in a test environment whether legacy applications or misconfigured systems depend on these protocols. Generally, with a correctly configured DNS, disabling them is trouble free and provides a significant security gain.

What stops NTLM relay? The most effective measure is enforcing SMB signing on all systems. When SMB signing is enforced, the captured authentication cannot be forwarded to another system and used there. In addition, restricting NTLM use and moving to Kerberos where possible largely neutralizes relay attacks.

Is a strong password enough for this attack? A strong password makes offline cracking of the captured hash harder and is important. However, in an NTLM relay attack the password is never cracked, the authentication is forwarded directly. That is why a strong password alone is not enough, you also need to disable LLMNR/NBT-NS and enforce SMB signing.

Sources

For internal network and Active Directory penetration testing, you can talk to our team at Ankara Hacettepe Technopark. Contact DSET.